The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) presented further guidelines on HIPAA and COVID-19. The new guidance presents cases when covered entities permit disclosures of protected health information (PHI) as per the HIPAA Privacy Rule to help make certain that first responders and others have the PHI of people who were exposed to SARS-CoV-2 or have COVID-19 symptoms.
The new guidance report has a Q&A format explaining the instances covered entities are allowed to divulge PHI like names and other identifying data to first responders, police officers, paramedics, and public health regulators without the need for a HIPAA authorization.
The document states that as per the HIPAA Privacy Rule, PHI disclosures are allowed any time the data is needed to give treatment if it is demanded by law, if first responders including paramedics are in danger of contracting COVID-19 and need to have data to avoid infection, and if disclosure can stop or minimize a serious and certain threat.
OCR additionally confirms that PHI disclosure is authorized if it is a requested response by a correctional establishment or law enforcement officer who has legal custody of an inmate or a person; when PHI is needed to provide medical services to a person to ascertain the wellness and protection of a person or persons in the organization; if a person is expected to move a person; and when PHI is necessary to retain the safety, protection, and peace in a correctional establishment.
OCR clarifies that a hospital is allowed to give a listing of names and addresses of all identified COVID-19 positive persons to an EMS dispatch when required to respond to a call. That data may then be utilized by a staff responding to an emergency call at the patient’s area to enable the taking of extra safety practices, like putting on personal protective equipment (PPE).
911 call center personnel could request data regarding a patient’s symptoms so as to know if there is a threat they were infected with SARS-CoV-2. Facts could then be handed to law enforcement officials and other people responding to a case at the person’s place to make sure they take on protective measures.
In all instances, a covered entity need to make real efforts to limit the disclosed details to the minimum information required to achieve the main objective for the disclosure.
Our country really needs our early responders and we should do all we could to ensure their security while they secure the health of other people. The guidance helps make certain that early responders will have access to medical data to help keep patients and the public secure.
The guidance report – COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities – is available for download on the HHS website.